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ABSTRACT 



A surveillance system is designated to detect terrorists in a crowded 
area to prevent a potential attack. Such a system usually does not have the 
capacity to screen all the people in the area. If the sojourn time distribution 
of a terrorist is different from that of the other people in the crowd, then it is 
possible to increase the probability of detecting a terrorist in time by using a 
decision rule to choose whom to inspect next. We use a queueing model with 
impatient customers to describe the interaction between the surveillance 
system and the surveyed people. We identify a few cases when a simple 
service rule — such as the first-come-first-serve mle — is optimal. In general, 
we develop a heuristic policy that is particularly effective in an area with 
heavy traffic, such as an airport check-in lobby. 
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1 Introduction 



Terrorist attacks — such as bombing, assassination of political figures, and release of poison 
gas in a crowd — are serious threats in many regions of the world. A significant terrorist 
attack occured in 1972 at a ticket counter in Lod International airport near Tel Aviv, Israel, 
where a three-man hit squad from the Japanese Red Army killed 26 people and injured 
78 more [1]. More recent examples include the 9/11 attack in 2001, the Bali bombings 
in 2002 and 2005, and the London bombings in 2005. Numerous instances in the past 
suggest that terrorists typically aim their attacks at crowded locations — such as restaurants, 
transportation terminals, popular tourist spots, political rallies, and subway stations — to 
create chaos and cause damage. The consequences of such terrorist attacks are casualties, 
damaged property, and a major disruption of daily life. 

Response actions for countering terrorist attacks range from politically and socially driven 
attempts to deter recruitment of terrorists, through intelligence-based arrests of suspects, to 
surveillance and protection of potential targets. While arguably it would be most effective 
to go after the sources of such attacks — the terrorist organizations and their infrastructure — 
implementing such a policy has not been very effective so far. Consequently, the authorities 
still need to protect the public from the end-operators of such organizations (assassins, suicide 
bombers, and the like) by timely detection and effective response. In this paper we focus on 
that last line of defense — the problem of detecting, as early as possible, a terrorist attack on 
a public target. 

Several attempts have recently been made to model and analyze detection and response 
actions associated with counterterrorism and homeland security. Jacobson et al. [6] consider 
the problem of baggage screening procedures at airports. Their objective is to optimize the 
performance of this process subject to a finite amount of screening resource. McLay et al. 
[11] model a multilevel screening process for airline passengers that are subject to profiling. 
Wein and Liu [17] analyze a single facility milk production/distribution supply chain that 
is the victim of a deliberate release of botulinum toxin. They conclude that a timely and 
specific in-process detection policy has the potential to eliminate the threat of this scenario 
at a relatively low cost. Kaplan et al. [8] combine a stochastic model of blood donation with 
an epidemic model to assess whether screening blood donors could provide an early warning 
of a bioterror attack. Kress [9] develops a model that estimates the effect of a suicide attack, 
based on which Kaplan and Kress [7] model and analyze a detection scheme for suicide 
bombers in urban settings. 

1.1 Research Problem 

We consider a large, enclosed area — henceforth called arena — such as an airport check-in 
area or a popular tourist attraction. An array of video cameras monitor the arena and feed 
real-time video streams to a control center, where a security team screens people in two 
phases. In the first phase, the people in the arena are examined with naked eyes and each 
person is immediately put into one of two groups: nonsuspects and suspects. Only suspects 
are subject to the second-phase screening, which includes taking their biometric signature 
(such as face structure, hair color, etc.) and running it through a terrorist database for 
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comparison. In case of a positive match, the suspect is classified as a potential terrorist 
and security forces are notified to take proper actions; otherwise, the suspect is reclassified 
as a nonsuspect and the security team moves on to conduct the second-phase screening on 
another suspect. The problem is to determine which suspect the security team should go 
after first, when faced with many suspects who are subject to the second-phase screening. 

Two observations motivate our research problem. First, because the second-phase screen- 
ing takes time, the security team may not be able to inspect all suspects before they leave 
the arena. Second, because a terrorist’s intention and action are different from those of other 
people in the arena, his sojourn time distribution may be different too. Consequently, by 
carefully choosing which suspect to inspect next, one could potentially increase the prob- 
ability of detecting a terrorist in time. In this paper, we develop a queueing model with 
impatient customers to analyze this problem, and draw insights into the effect of scheduling 
policies on such a surveillance system. 

1.2 Overview and Outline 

The contribution of this paper is twofold. From a theoretical standpoint, we build a queueing 
model with impatient customers that describes the antiterrorist surveillance system. There 
are two types of customers — terrorists and nonterrorists. The novelty of this queueing model 
is that only one type of customer (terrorists) is worth serving, but the server does not know 
a customer’s identify until service completion. From an application standpoint point, we 
develop scheduling policies for an antiterrorist surveillance system that can improve the 
probability of detecting a terrorist in a crowded area. 

The rest of this paper is organized as follows. In Section 2 we discuss the operational 
setting and develop a queueing model that describes it. In Section 3 we discuss the case when 
the sojourn times of customers follow exponential distributions, and identify a few cases 
where the optimal policy can be explicitly determined. In Section 4 we consider general 
sojourn time distributions, and develop a heuristic policy that is particularly effective in 
heavy-traffic situations. Conclusions and future research directions are discussed in Section 5. 

2 The Operational Setting and a Queueing Model 

In this section, we describe the operational setting and formulate the second-phase screening 
problem as a single-server queueing control problem. 

Consider a terrorist who attempts an attack in a crowded area, called arena, such as an 
airport check-in hall. The objective of the surveillance system is to detect the terrorist in time 
so that the security forces can take proper actions to prevent or mitigate the attack. People 
who arrive to the arena are immediately classified as suspects or nonsuspects. The suspects, 
who arrive according to a Poisson process, generate a queue with respect to the second- 
phase screening of the surveillance system. Each suspect is independently a red customer 
(terrorist) with probability p, or a white customer (nonterrorist) with probability 1 — p. A 
customer (suspect) leaves the queue after a random amount of time independent of whether 
service (second-phase screening) has started. The sojourn time of a white customer, which 
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is the time between arrival to the arena and its departure, follows a distribution function 
Fw(*)* The sojourn time of a red customer, which is the time between arrival to the arena 
and the moment he initiates the attack, follows a distribution function 

The service at the second-phase comprises a continuous monitoring of the suspect, while 
running the suspect’s biometric signature through a terrorist database for comparison. The 
security team is the server^ which can serve one customer at a time. The service times (for 
database search) are independent and identically distributed random variables with distri- 
bution function Fs{-). We assume that if the surveillance system completes the screening 
of a red customer before he initiates the attack, then the attack is prevented. If the red 
customer initiates the attack while in service, the continuous monitoring enables the system 
to detect it and instigate a quick response (e.g., instructing the crowd to “hit the deck”) 
such that the attack is mitigated. 

White customers represent nonterrorists in the arena. If a white customer leaves the 
arena before ever entering service, he simply goes away and the queue length is reduced by 
one. If a white customer leaves the arena while in service, the queue length is reduced by 
one and the server becomes available. If a white customer completes the service, the server 
records his data and removes him from the surveillance queue. Because of the recorded data, 
this white customer will not be served again. 

Although the goal of the server is to serve a red customer, the server does not know 
the customer’s identity until the service is completed or when a red customer initiates an 
attack during service. If a red customer initiates his attack before entering service, then 
the surveillance system fails because it cannot prevent or even mitigate the attack. If a red 
customer enters service before initiating the attack, then the attack will be prevented (if he 
completes service) or mitigated (if he initiates the attack while in service). In either case, we 
assume that the surveillance system succeeds. The problem ends when a red customer departs 
the queue for the first time — either due to service completion or due to attack initiation. 
The objective function is to find a service discipline that maximizes the probability that the 
first departing red customer has entered service before initiating the attack. 

The server’s problem is to decide which customer in the queue to serve each time the 
server becomes available. Specifically, the state of the queue is given by 

(^1 ) ^2? • • • ? ^n) ) ^ ^2 ^ ^ tji^ 

with the interpretation that there are n customers in the queue, and the ith customer 
has stayed in the queue for ti time units. Note that we do not need to include the time 
since the last customer arrival in the state space because the customer arrival process is a 
Poisson process. A feasible policy is a function that maps a vector (tj, . . . ,t„) to an index 

i G {1, . . . , n}, for n = 1,2, Although the model allows p to be an arbitrary number 

between 0 and 1, we are most interested in the case when p is close to 0. 

In queueing theory, there is extensive research that concerns dynamic scheduling of a 
multiclass queue. In a service center, different classes of customers bring in different rev- 
enue and require different service times; for example, see Miller [12] and Harrison [4]. In a 
production system, switching from one customer class to the other may require setup times; 
for example, see Reiman and Wein [15] and Olsen [13]. More recently, there is a growing 
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interest in a multiclass queue in heavy traffic; for example, see Bertsimas and Mourtizinou 
[2], Plambeck et al. [14], and Harrison and Zeevi [5]. The major distinction of our model 
from these earlier works is that a customer does not reveal his identity upon arrival, while 
the server can gather information about a customer’s identity by studying his sojourn time. 
To the best of our knowledge, our work is the first to address this type of problem. 



3 Exponential Sojourn Time Distribution 

This section presents the case when both Fn and Fw are exponential. In Subsection 3.1 we 
study the first-come-first-serve rule, and in Subsection 3.2 we study the last-come-first-serve 
rule. In Subsection 3.3 we consider the random- selection rule, and compare all three rules 
numerically. Although our primary interest is to study a nonpreemptive service system, 
in Subsection 3.4 we discuss a preemptive service system that complements our theoretical 
results. 

3.1 First-Come-First-Serve (FCFS) Rule 

According to the FCFS rule, the server always serves the customer who has stayed the 
longest in the queue. If the sojourn time distributions for both red and white customers are 
exponential, the next theorem presents a sufficient condition for the FCFS rule to be optimal. 
Note that the theorem does not require the service time distribution Fs to be exponential, 
neither does it require the arrival process to be a Poisson process. 

Theorem 3.1 If both Fh and Fw are exponential with respective rates Or < 6w, then the 
FCFS rule is optimal for an arbitrary distribution function Fs and for an arbitrary arrival 
process. 

Proof: Consider an arbitrary state {ti,t 2 , . . . ,tn) such that t\ > t 2 > ■ • ■ > tn- To prove 
the theorem, we will show that for each policy that does not serve customer 1 first, we 
can find a better policy that does start with customer 1. The proof relies on an argument 
that involves stochastic coupling between two sample paths. A reference to the stochastic 
coupling technique can be found in Section 9.2 in Ross [16]. 

Consider two servers — server A and server B — each facing the state (ti, . . . , t„). Suppose 
server B uses a policy (j), in which <f){ti, . . . ,tn) = i 1. Consider a policy for server A 
as follows: Serve customer 1 first. If server A finds customer 1 to be white and no red 
customer has left (unserved) yet, then (1) if customer i is not in the queue, switch to policy 
<j) thereafter; (2) if customer i is still in the queue, then relabel customer i as customer 1 and 
switch to policy 4> thereafter. 

Let p{t) denote the probability that a customer in the queue is red if he has stayed in 
the queue for t time units. Using Bayes’ rule, we can calculate that 

, . pFRjt) 

pFR(t)-i-{l-p)Fw{ty 
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where Fn{t) = 1 — Ffi{t) and Fw{t) = 1 — Fw{t) are the tail distribution functions of a red 
and white customers’ sojourn time, respectively. Because both Fn and Fw are exponential 
with respective rates Or < Ow, it follows that p{t) increases in t (the first derivative of 
Equation (1) is positive). Therefore, we have that p(ti) > p(^ 2 ) > • • • > p{tn)- 

Let servers A and B serve queues A and B, each in state (<i , . . . , t„), respectively. Because 
p{ti) > p{ti), we are able to couple customer I’s identity and customer i’s identity in queues 
A and B in the following 5 cases: 

1. With probability p(ti)p(tj), customers 1 and i in both queues are red: Because of the 
memoryless property of exponential distributions, the remaining sojourn times of cus- 
tomers 1 and i are identically distributed in both queues. Therefore, both servers will 
eventually catch the red customer in service if no other red customer leaves (unserved) 
sooner. As a consequence, the probability that the first red customer leaving queue A 
will receive (at least partial) service is the same as that in queue B. 

2. With probability (1 — p(ti))(l — p{U)), customers 1 and i in both queues are white: In 
this case, we couple customer I’s (i’s) remaining sojourn time in queue A and customer 
i’s (Ts) remaining sojourn time in queue B. In addition, we couple the identity of all 
other customers and their respective remaining sojourn times in two queues, as well 
as the arrival process and sojourn times of future customers. Finally, we couple the 
service times for the two servers such that the fcth service initiated by server A takes 
the same amount of time as the fcth service initiated by server B. By doing so, we 
can see that both queues will follow the same sample path — except that the labels 
of customers 1 and i are swapped. Consequently, the probability that the first red 
customer leaving queue A will receive (at least partial) service is the same as that in 
queue B. 

3. With probability (1 — p{t\))p{ti), customer 1 in queue A and customer i in queue B 
are red, and customer i in queue A and customer 1 in queue B are white: Similar to 
case 1, the two servers will do equally well in terms of the probability of success. 

4. With probability (1 — p{ti))p{ti) , customer 1 in queue A and customer i in queue B 
are white, and customer i in queue A and customer 1 in queue B are red: Similar to 
case 2, two servers will do equally well in terms of the probability of success. 

5. With probability p{ti) — p{ti), customer 1 is red in both queues A and B, and customer 
i is white in both queues A and B: In this case, we couple the customer identities for 
the other n — 2 customers in queues A and B, and all their future arrivals. Because 
server A starts with a red customer and server B starts with a white customer, it 
follows that the probability that the first red customer leaving queue A will receive (at 
least partial) service is greater than that in queue B. 

In summary, in cases 1-4, the two servers do equally well, while in case 5 server A can do 
better than server B. It follows that there exists a policy that can do better than policy 4> by 
immediately serving customer 1 — the customer who has stayed in the queue for the longest 
period of time. □ 
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Although Theorem 3.1 holds for an arbitrary value of p, we are particularly interested in 
the case when p — > 0, because a terrorist attack is a rare event. To compute the objective 
function as p ^ 0, we first construct a queue with only white customers arriving according 
to a Poisson process with rate A, and then let a red customer arrive in steady state. If 
the service time distribution also follows an exponential distribution, then we can obtain a 
closed-form solution for our objective function — the probability that the red customer who 
arrives in steady state will enter service before leaving the queue (initiating the attack). 

Let fi denote the rate of the exponential distribution associated with the service times. 
With white customers arriving according to a Poisson process with rate A, the steady-state 
probability that there are n customers in the queue can be found by a Markov chain argument 
(see Donald and Harris [3] for a derivation), and is given by 



i+Er=im=i(;r^^)’ 



for n = 0, 



( 2 ) 



and 



n n /_A_\ 
1=1 V fj.+id\Y ' 



1 + Er=i 



^ 

. *i — 1 V 



y 



for n = 1, 2, . . . . 



If a red customer finds n white customers in the queue upon arrival, then the probability 
that he will enter service before leaving is the probability that all those n white customers 
depart — either due to impatience or due to service completion — before the red customer 
does. This probability can be obtained by the memoryless property of the exponential 
distributions: 



A / /i + i9\v \ 

i=i 



Therefore, with the FCFS rule, the probability that the red customer arriving in steady state 
will enter service before leaving is 



, \ A/ fj, + i6w \j 

1 + Er=i nUjnk;) n=i Lvi + Er=i nLi(;iTk;)>' ' 

We plot the preceding in Figures 1 and 2 with different parameters, which will be discussed 
later on at the end of Section 3.3. 



3.2 Last-Come-First-Serve (LCFS) Rule 

With the LCFS rule, the server always serves the customer who most recently joined the 
queue. Somewhat surprisingly, the counterpart of Theorem 3.1 when 6r > 9w is not true 
even if Fs is also exponential. For example, if there is only one customer in the queue, and 
that customer has been in the queue for a long time so that it is most likely white, then 
the server may prefer waiting for the next new arrival rather than serving that very old 
customer, as shown in the next example. 
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Example 3.1 

Suppose X = = I, 9fi = ^0, 9w = 0.1, and p = 0.8. Consider a situation when there is only 

one customer in the queue — referred to as customer Z throughout this example — who joined 
the queue one time unit ago. Recall from Equation (1) that customer Z is a red customer 
with probability p{l) ^ 0.0002. 

With the LCFS rule, the server initiates service with customer Z. Let A denote the event 
that the first departing red customer will receive service under the LCFS rule. We can 
compute P{A^} by conditioning on the identity of customer Z: 

P{A‘^} = p(l)P{/l‘^|customer Z is red} + (1 — p(l))P{>l‘^lcustomer Z is white) 

> ^ 9n + 9w + p 

w 0.34, 



where the inequality follows because conditional on customer Z being white, event A*^ occurs 
as long as the following three events occur sequentially: (1) a new customer arrives before 
customer Z departs (whether due to impatience or due to service completion); (2) the new 
customer is red; and (3) the new customer leaves (unserved) before customer Z departs. 
Hence, we have that P{A} < 0.66. 

An alternative policy is for the server to stay idle until a new customer arrives, and 
then immediately serve the newly arrived customer. Let B denote the event that the first 
departing red customer will receive service under this policy. We can compute P{B) by 
conditioning on the identity of customer Z: 



P{B) = 

> 



p(l)P{P|customer Z is red) + (1 — p(l))P{P|customer Z is white) 



(1 -p(l))p 

0.73, 



9r + p 
A + 0R + p 



where the inequality follows because conditional on customer Z being white, event B occurs 
as long as the first arrival is a red customer, and that red customer departs (either due to 
impatience or due to service completion) before another new customer arrives. 

Finally, because P{B} > 0.73 > 0.66 > P{A], it follows that the LCFS rule is not 
optimal. □ 



Similar to the FCFS rule discussed in Section 3.1, we next let p — > 0 and calculate the 
objective function — the probability that the first red customer departing the queue receives 
(at least partial) service. As p — » 0, we can find this probability by first constructing a queue 
with only white customers and letting a red customer arrive in steady state. The objective 
function in the case of p — ♦ 0 becomes the probability that a red customer arriving in steady 
state will enter service before leaving the queue. 

First note that if the server is idle when a red customer arrives, then the red customer 
enters service immediately. If the server is busy when a red customer arrives, then with the 
LCFS rule, the current number of white customers in the queue is irrelevant to whether the 
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red customer will enter service before leaving. In order to obtain the probability that the 
red customer will enter service before leaving if the server is busy upon the red customer’s 
arrival, we next formulate a Markov chain. 

Suppose the server is busy when a red customer arrives and joins at the end of the queue. 
Define a Markov chain to represent the state of the queue when a red customer is present. 
Denote by k the state if the server is busy with a white customer, and there are A; — 1 white 

customers in the queue behind the red customer. A: = 1,2, Let the state become 0 when 

the red customer enters service, and —1 when the red customer leaves before entering service. 
Note that by definition, states 0 and —1 are absorbing, and that the Markov chain starts in 
state 1. 

Let Ofc, A: = 1, . . . ,oo, denote the probability that the Markov chain in state k will ever 
enter state A: — 1 before the red customer leaves (entering state —1). By definition, a\ is the 
probability that a red customer will enter service before leaving if the server is busy upon 
his arrival. 

To obtain «i, we first find an expression for ak by conditioning on whether the next 
event is a new arrival, a departure of a white customer, or the departure of the unserved red 
customer (initiating an attack): 

_ ^ /i + kOw .. _ 

Or + a + /i + kOw ^ 0 R \ ^ kOw 0 r X ^ kOw 

for A: = 1,2, Solving for a* yields 



ttfc = 



fi + k0\ 



w 



Or + X + + kO\Y — Ao;t+i 

Because afc+i G [0, 1], the preceding implies that 

ji + k0\^ jji + kOw 



Or + a + /i + k0\ 



w 



<Otk< 



0r-\- fJ' kOw 



(3) 



(4) 



Consequently, we can choose a large value of A:, use Equation (4) to bound and then use 
Equation (3) to recursively compute the bounds for ak-i,ock- 2 y • ■ ■ ,oi\- Because the bounds 
converge very quickly, we can approximate aj satisfactorily. 

Finally, we can compute the probability that the red customer enters service before 
leaving under the LCFS rule by 

1 • P{server idle in steady state} + ai • P{server busy in steady state) 



1 + Er., 



+ ai 



0-r 



+Er.iro.,(^) 



). 



where the steady-state probability follows from Equation (2). We plot the preceding results 
in Figures 1 and 2, which will be discussed at the end of Section 3.3. 
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3.3 Random Selection (RS) Rule 

Another service rule of interest is the RS rule, in which the server, when becoming available, 
selects the next customer at random. If both sojourn times are exponentially distributed and 
9ji = 6wy then all three rules — FCFS, LCFS, and RS — perform equally well for two reasons: 
(1) each customer in the queue still has a probability p of being red regardless of the amount 
of time he has stayed in the queue; and (2) the remaining sojourn times for all customers in 
the queue are independent and identically distributed because of the memoryless property 
of the exponential distribution. If 6ji ^ we would expect that the performance of the 
RS rule lies between those of the FCFS and the LCFS rules. 

As p 0, we can formulate a Markov chain to compute the performance of the RS 
rule in a similar way to that in Sections 3.1 and 3.2. We omit the derivation, but plot the 
performance of the RS rule in Figures 1 and 2 for comparison. As seen in these two figures, 
the FCFS rule is the best of the three when 0/^ < (in this case, the FCFS is optimal 
by Theorem 3.1), while the LCFS rule is the best when Qji < 0vv- However, FCFS is the 
most sensitive to the changes either in 6vv or in 0/?, while for LCFS the slope is relatively 
mild, especially when 0/? ~ This observation suggests that if the value of is highly 
uncertain — as Qy/ is typically much easier to estimate — then the LCFS rule is more robust. 

3.4 Preemptive Service 

Our queueing model assumes that the service is nonpreemptive because the screening pro- 
cess of a suspect cannot be interrupted. Although preemptive service — whereby the server 
can interrupt its current screening and switch to another customer upon a new arrival or 
any departure — is not a practical assumption, we are interested in such a variation from a 
theoretical standpoint. This subsection presents a theorem that complements Theorem 3.1 
in the nonpreemptive service case. 

Theorem 3-2 // iht service is preemptive^ and both Ffi and Fw cire exponential with re- 
spective rates 0j{ < Ow (respectively ^ Ofi > Qw)^ then the FCFS (respectively ^ LCFS) rule is 
optimal for an arbitrary arrival process if Fs is exponential 

Proof: We prove the optimality of the LCFS rule when Or > Ow^ while the proof for the 
optimality of the FCFS rule when Or < Ow follows a similar argument. 

Consider two servers — server A and server B — each facing the state (^i, ^ 2 ? • • • ? such 
that > ^2 > • • * > ^n- Suppose server B uses a policy 0, in which 0(^i, . . . ,^n) — i ^ n. 
Consider a feasible policy for server A as follows: Start service with customer n and continue 
until an arrival or departure, and thereafter switch to policy 0 if the next event is not a 
departure of a red customer (in which case the problem ends). Let Ea (or Er, respectively) 
denote the event that in queue A (or queue B, respectively) the first departing red customer 
receives (at least partial) service. To prove the theorem, we will show that P{Ea) > P{Er). 

Recall from Equation (1) that p{t) denotes the probability that a customer is red if he 
has stayed in the queue for t time units. Because Or > Ow and t\ > t2 > • — > tn^ it follows 
that p{t\) < p{t2) < • • • < p{tn)- We couple customer n’s identity and customer z’s identity 
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Figure 1; Probability that the first departing red customer receives (at least partial) service as 
a function of a white customer’s expected sojourn time. Fr, Fw, and Fs are all exponential; 
p — » 0, A = 2, l/9n = 6, and 1/p = 2. 



in queues A and B in the following 4 cases, and let the random variable / indicate which 
case takes place: 

1. With probability p{tn)p{ti), both customers n and i in both queues are red: Because 
(additional) sojourn times of red customers follow independent exponential distribution 
with rate Or, it follows that P{Ea\I = 1) = P{Eb\I = !)• 

2. With probability (1 — p(t„))(l — piU)), both customers n and i in both queues are 
white: Similar to case 1, because (additional) sojourn times for white customers follow 
independent exponential distribution with rate 6w, it follows that P{Ea\I = 2) = 
P{Eb\I = 2). 

3. With probability (1 — p{tn))p{ti), customer n is white and customer i is red in both 
queues: We couple the next event that takes place. If the next event is service comple- 
tion or customer i's (red) departure, then Eb occurs, but not Ea] otherwise, the two 
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Figure 2: Probability that the first departing red customer receives (at least partial) service 
as a function of a red customer’s expected sojourn time. Fr, Fw, and Fs are all exponential; 
p — > 0, A = 2, l/dw = 6, and 1/p = 2. 



servers will do equally well because the service distribution is exponential. Therefore, 

P{Eb\I = 3) - P{Ea\I = 3) > 0. 

4. With probability (1 — p{ti))p(tn), customer n is red and customer i is white in both 
queues; We couple the next event that takes place. If the next event is service com- 
pletion or customer n’s (red) departure, then Ea occurs, but not Eb', otherwise, the 
two servers will do equally well because the service distribution is exponential. As the 
situation is reverse to that in case 3, it follows that 

P{Ea\I = 4) - P{Eb\1 = 4) = P{Eb\I = 3) - P{Ea\I = 3) > 0. 

Finally, we have that 

P{Ea)-P{Eb) = Y^[P{EA\I = k)-P{EB\I = k)]P{I=^k) 

k=l 
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and the result follows. 



[P{E^\l = 4) - P{Eb\I = 4)][(1 - p{U))p{t„) - (1 - p{tn))p{U))] 
[P{Ea\I = 4) - P{Eb\I = 4)]{p{tn) - pm > 0, 

□ 

Note that contrary to Theorem 3.1, Theorem 3.2 does not hold for an arbitrary service 
distribution function Fs- A counterexample can be constructed intuitively as follows. Sup- 
pose that Fr and Fw are exponential with respective rates Or < Ow, and that Fs has a 
decreasing failure rate — that is, fs{t)/Fs{t) decreases in t, for t > 0 — so that the longer a 
customer has been in service, the longer (stochastically) his remaining service time becomes 
(for example, see Proposition 9.1.3 in Ross [16]). Granted, with the FCFS rule, the server 
always serves the customer who has the highest probability of being red. However, after 
serving the same customer for a long time without a conclusion, the remaining service time 
tends to be even longer (in the regular stochastic sense) . At that point, the server may prefer 
to switch to another customer for a fresh service time, even though the probability for this 
other customer to be red is slightly smaller. 



4 General Sojourn Time Distributions 

This section presents the case when Fr and Fw do not necessarily follow exponential dis- 
tributions. In Subsection 4.1, we discuss the difficulty of finding the optimal policy in the 
case of general sojourn time distributions, and present an example to demonstrate it. In 
Subsection 4.2, we develop a heuristic policy, which works particularly well under heavy 
traffic — the case we expect in real-world applications. In Subsection 4.3, we use simulation 
to numerically evaluate different policies. 



4.1 Difficulty of Finding the Optimal Policy 



We first investigate whether we can relax the conditions specified in Theorem 3.1 so that 
the FCFS rule is still optimal under weaker conditions. Intuitively, for the FCFS rule to be 
optimal, two conditions must be satisfied: (1) the longer a customer has stayed in the queue, 
the more likely he is a red customer; and (2) the longer a customer has stayed in the queue, 
the sooner he tends to leave the queue according to his sojourn time distribution. 

For condition (1) to hold, we need p{t) in Equation (1) to increase monotonically in t. 
Using calculus, we can show that for p{t) to satisfy this property, a sufficient condition is 
that Fr has a smaller failure rate than Fw', in other words. 



/fl(^) ^ fwjt) 

pR{t) - Fw{ty 



for all t > 0, 



(5) 



where / and g are the density functions and Fr and Fw are the tail distribution functions. 

For condition (2) to hold, we need {R — t\R>t)to decrease in t in the regular stochastic 
sense, where R denotes a random variable with distribution function Fr. That is, we need 



P{R — t > s|R > t} 



Ffl(t + s) 
Fnit) 
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to decrease in t for all s > 0. Straightforward calculation shows that the preceding decreases 
in t if and only if fR{t)/Ffi{t ) — the failure rate of Fa — increases in t. Consequently, condition 
(2) holds if the failure rate function is increasing for both Fr and Fw- 

If the failure rate function is increasing for both Fr and Fw, and the failure rate of Fr 
is smaller than that of Fw, then the longer a customer has stayed in the queue, not only is 
the customer more likely to be red, but the customer also tends to leave the queue sooner. 
Hence, it makes intuitive sense for the FCFS rule to be optimal. However, the next example 
shows that this conjecture is not true in general. 



Example 4.1 

Suppose that Fr and Fw are identical with the following (increasing) failure rate function: 



m) 



fwjt) 

Fw{t) 



0 , 

1 , 

10000, 



for 0 < t < 2, 
for 2 < t < 4, 
for t > 4. 



Also suppose that the probability of a red customer is p = 0.5. Because Fr and Fw are 
identical, the server cannot learn about a customer’s identity from the amount of time the 
customer has stayed in the queue. Hence, p{t) = p = 0.5 for all t > 0. 

Suppose there are three customers with ti = 2.99, t 2 = 2.01, and fa = 1, and that the 
service time distribution Fs is deterministic and equal to 1. In addition, assume A = 0.0001 
so that the effect of future arrivals is negligible. Conditional on the event that at least one of 
the three customers currently in the queue is red, we use Monte Carlo simulation to compare 
the service orders 1, 2, 3, and 2, 1, 3. It turns out that the probability the first departing 
red customer will receive (at least partial) service is 0.720 for the service order 1, 2, 3, and 
0.752 for the service order 2, 1, 3 (the standard error of each estimator is less than 5 x 10“^). 
Therefore, it is better to start with customer 2 rather than with customer 1, and the FCFS 
rule is not optimal. 

To gain some intuition about this example, first note that the failure rate function remains 
a constant for 2 < t < 4, and the service time is deterministic and equal to 1. Because 
[U,ti + 1] C [2,4) for i = 1,2, the time it takes for the server to become available is 
identically distributed regardless of whether the server starts with customer 1 or customer 
2. In addition, if the server starts with customer 1, the probability that customer 2 is still 
in the queue when the server becomes available is the same as the probability that customer 
1 is still in the queue if the server starts with customer 2. Consequently, the number of 
customers between customers 1 and 2 that the server can serve by following the order 2, 1, 
3 is identically distributed to that number when the server follows the order 1, 2, 3. 

However, by starting with customer 2, the time it takes for the server to become available 
for customer 3 is stochastically smaller than by starting with customer 1, because as soon as 
a customer spends 4 time units in the queue, it will leave almost immediately. Consequently, 
by starting with customer 2, the server has a better chance to serve customer 3, and therefore 
with the service order 2, 1,3, the server has a better chance to serve the first departing red 
customer. □ 
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4.2 Heuristic Policy 

To develop a heuristic policy, recall that our original problem can be stated as follows: 

A; Customers arrive according to a Poisson process with rate A. Each customer is in- 
dependently a red customer with probability p or a white customer with probability 
1 — p. Choose a service rule to maximize the probability that the first departing red 
customer receives (at least partial) service. 

Recall that we are primarily interested in the case when p — > 0 because, in reality, a terrorist 
attack — represented by a red customer — is a rare event. As p — » 0, our original problem in 
A can be restated as follows: 

B: Suppose white customers arrive according to a Poisson process with rate A, and a red 
customer arrives at the queue in its steady state. Choose a service rule to maximize 
the probability that this red customer will enter service before leaving the queue. 

Consider a related problem: 

C: Customers arrive according to a Poisson process with rate A, where each customer 
is red with probability p or white with probability 1 — p. Choose a service rule to 
maximize the long-run proportion of red customers who enter service before leaving. 

As p — ♦ 0 in problem C, the interarrival times between successive red customers follow an 
exponential distribution whose mean converges to infinity. Therefore, the number of white 
customers in the queue when a red customer arrives converges to the steady-state distribution 
of a system where white customers arrive according to a Poisson process with rate A. In 
other words, as p 0, problem C reduces to problem B. It then follows that problems A 
and C become equivalent as p — > 0. Next, we motivate our heuristic policy by considering 
problem C. 

In problem C, suppose we earn a reward of 1 for each red customer served, so that the 
objective function becomes maximizing the long-run reward rate. We propose a heuristic 
policy that chooses the customer with the highest reward rate — the ratio between the ex- 
pected reward and the expected time spent if the customer is served. Let R, W, and S 
denote random variables with respective probability distribution functions Fr, Fw, and Fs- 
Suppose a customer has stayed in the queue for t time units, then serving that customer 
yields a reward rate equal to 

. Pfcustomer is red I sojourn time is at least t} 

T'ii) ' ■ - " • ' — ■ ■ ' ■■ I ■ I 

Efadditional time in queue if served] 

P(0 

p(t)E[min(i? — t, 5)|i? > t] -H (1 — p(t))E[min(W — t, 5)|W > t] ’ 

where p{t) is given by Equation (1). As p — > 0, we can compare the reward rate between 
any two customers by 



^(<i) 



lim , ^ 
p— 0 r{t2) 



= ( 



FR{ti)/F\v{ti) 



FR{t2)/ Fw{t2) 



E[min(W-ti,5)|W > U]J / VE[min(W - < 2 , 



)• 



(6) 
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Therefore, we define a score function for a t-time-unit-old customer as 



/.X _ F[j{t)/Fw{t) 

^ ’ ~ E[mm{W -t,S)\W > t]' 



( 7 ) 



and let the server choose the next customer that obtains the highest score. In other words, 
if there are n customers in the queue with customer i having stayed in the queue for U time 

units, this heuristic policy will next serve customer j = argmaxj=i 

To further compute the denominator in Equation (7), we calculate 



E[mm{W - t, S)\W > t] 



[ F{min(IT — t, S) > x\W > t)dx 
Jo 

f P{W — t> X and S > x\W > t)dx 
Jo 

r P{W - t > x\W > t}P{S > x\W > t}dx 
Jo 

r 






Fw{t) 



( 8 ) 



Consequently, putting Equations (7) and (8) together gives that 



s{t) = 



Fait) 

/o°° Fw{t + x)Fs{x)dx' 



( 9 ) 



The score in Equation (9) is computed for each customer individually, based on the time 
he has spent in the queue. One advantage of this score is that it is easy to compute. In 
practice, we can compute the score s{t) for all values of t beforehand, which allows easy 
implementation in real time. Observe that a customer’s score does not depend on the 
number of other customers in the queue nor the customer arrival rate A. Therefore, this 
heuristic cannot be optimal in general. In particular, when the traffic is relatively light, the 
server should take into account the possibility of being idle when the queue becomes empty, 
rather than always choosing the customer that yields the highest reward rate. Hence, in 
a light-traffic system it is possible to devise a policy that is specifically tailored for given 
distributions F^, Fw, and Fs, such as the case in Example 4.1. On the other hand, in a 
surveillance system under heavy traffic — the case we expect to see in reality — there are many 
customers to choose from each time the server becomes available. Therefore, the server need 
not be concerned about having no customers to serve, and should focus on selecting the 
customer that yields the highest reward rate. Consequently, we expect our heuristic policy 
to be effective in a heavy-traffic system. 

We next present the score function s{t) in three examples summarized in Table 1. In 
each example, we let Fr and Fw be Erlang distribution functions, denoted by Erlang(m, 
P), where m is the shape parameter and /? the scale parameter. In addition, we let Fs be 
a uniform distribution function. Each example represents a distinctive relationship between 
Fr and Fw- 

The first example represents the case when Fr is stochastically larger than Fw- We 
let Fr ~ Erlang(6, 1.2) and Fw ~ Erlang(6, 1), so that they have the same coefficient of 
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Table 1: Three examples for the score function s{t). 



Fr 

1 Erlang (6, 1.2) 

2 Erlang (6, 1) 

3 Erlang (6, 1) 



Fw 

Erlang (6, 1) 
Erlang (6, 1.2) 
Erlang (2,3) 



Relationship 

Fr stochastically larger than Fw 
Fr stochastically smaller than Fw 
Fr has smaller variance 



variation. In Figure 3, we plot the score function s{t) in Equation (9) when Fr is a uniform 
distribution with different parameters, ranging from [/(0.5, 1.5) to C/(7.5,8.5). As seen in 
Figure 3, regardless of the service time distribution Fs, our heuristic policy coincides with 
the FCFS rule. This result is relatively easy to understand, because the longer a customer 
has stayed in the queue, not only is it more likely to be red, but it also tends to leave the 
system sooner even if it is white. Hence, the score increases in the time a customer stays in 
the queue. 

The second example represents the case when Fr is stochastically smaller than Fw- 
We let Fr ~ Erlang(6, 1) and Fw ~ Erlang(6, 1.2), so that they have the same coefficient 
of variation. The score function s{t) is plotted in Figure 4. To intuitively understand 
the behaviors of these curves, first note that FR{t)/Fw{t) (the numerator in Equation (7)) 
is monotonically decreasing in t, which implies that the longer a customer has stayed in 
the queue, the less likely it is a red customer. Second, the denominator in Equation (7) 
represents the expected time the server will be kept busy with the customer should it be 
a white customer. When the service time distribution is 17(0.5,1.5), this expected time 
F[min(W — t, 5)|W > t] — where W and S are two independent random variables with 
respective distribution functions Fw{-) and Fs(-) — remains roughly a constant for t < 1, 
because the service time distribution Fr ~ 17(0.5, 1.5) dictates the time the server remains 
busy. On the other hand, if the service time distribution Fs ~ 17 (7.5, 8.5), then F[min(W — 
t, 5')|W > t] decreases more significantly as t increases, because it becomes more likely the 
server will become free due to the premature departure of the customer under service. As a 
consequence, when the service time becomes stochastically larger, it becomes more desirable 
to serve a customer that has stayed in the queue for 6 time units or so. 

The third and final example represents the case when Fr and Fw have the same mean, 
while Fr has a smaller variance. In particular, we let Fr ~ Erlang(6, 1) and Fw ~ 
Erl^lng(2, 3). As seen in Figure 5, s(t) reaches its maximum around t = 4 mainly because the 
likelihood ratio FR{t)/Fw{t) exhibits a similar shape, and that a 4-time-unit-old customer 
is more likely to be red than other customers. A more important observation is that, in this 
case, the heuristic policy is significantly different from either FCFS or LCFS rules. 

Finally, recall from Section 3 that if Fr is exponential with rate Or and Fw is exponential 
with rate Ow, then the FCFS rule is optimal if Or < Ow- It is straightforward to verify that 
in this special case our heuristic policy does yield the optimal policy. 
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Figure 3; Score function s{t); Fr ~ Erlang(6, 1.2), Fw ~ Erlang(6, 1), and Fs follows four 
different uniform distributions. 



4.3 Numerical Experiments 

In this subsection, we first develop a simulation algorithm to evaluate the performance of a 
policy, and then use the algorithm to compare different policies numerically. 

To simulate the performance of a policy, first note that as p — > 0, our original problem 
is equivalent to problem B stated in the beginning of Subsection 4.2. For a given service 
rule, we let the white customers arrive according to a Poisson process with rate A, and let 
a red customer arrive in steady state. Let / = 1 if that red customer enters service before 
leaving, and 7 = 0 otherwise. Our goal is to estimate E[7], but naive estimation of E[I] is 
very inefficient. 

To overcome this issue, we generate a sample path of the queueing system where white 
customers arrive according to a Poisson process with rate A for the first n arrivals, and the 
server processes customers according to a given service rule — FCFS, LCFS, RS, or heuristic. 
After generating the sample path, we turn our attention to each customer one at a time. For 
the jth arriving customer, define the random variable 7j = 1 if that customer would have 
received service had it been a red customer, while all other customers are white; let Ij = 0 
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Figure 4: Score function 5(f); Fn ~ Erlang(6, 1), ~ Erlang(6, 1.2), and Fs follows four 

different uniform distributions. 



otherwise. Hence, our estimator is Ij/n. Because white customers arrive according to 
a Poisson process, and because Poisson arrivals see time averages (see Wolff [18]), it follows 
that (£"=i Ij)/n converges almost surely to E[I] as n tends to infinity. 

Our simulation algorithm uses steady-state simulation to get multiple estimators in a 
single simulation run. There are two issues related to a steady-state simulation. First, there 
is initial bias because the system is not in steady state when we start the simulation with 
an empty queue. Second, the random variables Ij and Ij+i are not independent. If Ij — 1, 
it becomes more likely the queue has few customers, which in turn makes Ij+i more likely 
to take on value 1. To resolve these two issues, we allow a prolonged warm-up period before 
collecting data, and use batch means to estimate the standard error of our estimator; see, 
for example. Law and Kelton [10]. We choose the batch size so that with probability close 
to 1 the first customers in consecutive batches will never coexist in the system. 

For a numerical experiment, we choose Fn ~ Erlang(6, 1), Fw ~ Erlang(2,3), and 
Fs ~ f/(1.5, 2.5). Table 2 compares the probability that a red customer will receive service 
as p —V 0 for four policies when the customer arrival rate A varies. In simulation experiments, 
the standard error is about 10“® of the estimator. We choose the performance of the RS 
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Figure 5: Score function s{t); Fr ~ Erlang(6, 1), Fw ~ Erlang(2,3), and F$ follows four 
different uniform distributions. 



rule as the benchmark, and report the performance of the other three rules as ratios to the 
benchmark. 

As seen in Table 2, the heuristic policy always yields the highest probability of serving 
a red customer. In addition, the heuristic policy’s relative improvement over the RS rule 
gradually increases as A increases. This observation is not surprising, as we argued in Sec- 
tion 4.2 that the heuristic policy is particularly suitable in a heavy-traffic system. Another 
interesting observation is the comparison between the FCFS rule and the LCFS rule. When 
A = 1, the traffic is light, so most of the time the customers in the queue are relatively new 
to the queue. As seen in Figure 5, the score function s{t) increases in t when t is small, so 
the FCFS rule performs better than the LCFS rule in a light-traffic queue. When A = 6, 
the traffic is much heavier, so with the FCFS rule the server will frequently serve customers 
who have stayed a long time in the queue. Because the score function s{t) < s(0) for t > 8 
and with the LCFS rule most of the time the server serves a customer whose age is close to 
0, the LCFS rule performs better than the FCFS rule. 
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Table 2; Probability of serving a red customer in different policies as p ^ 0, Fr 
Erlang(6, 1), Fw ~ Erlang(2,3), and Fs ~ C/(1.5,2.5). 



A 


RS 




Ratio to RS Rule 


RS 


FCFS 


LCFS 


Heuristic 


1 


0.612 


1.000 


1.106 


0.922 


1.132 


2 


0.311 


1.000 


0.963 


0.900 


1.230 


3 


0.205 


1.000 


0.747 


0.890 


1.257 


4 


0.153 


1.000 


0.586 


0.888 


1.270 


5 


0.122 


1.000 


0.473 


0.886 


1.278 


6 


0.101 


1.000 


0.390 


0.885 


1.281 



5 Concluding Remarks 

In this paper we developed a single-server queueing model with impatient customers to 
describe a surveillance system for detecting terrorists in a heavy-traffic arena. Two types of 
customers — terrorist and nonterrorist — arrive to the arena, but a customer’s identity is not 
revealed until the server completes the service, or if the customer leaves the arena (in the case 
of a nonterrorist) or initiates an attack (in the case of a terrorist). The server, however, can 
draw inference about a customer’s likely identity based on the time the customer stays in the 
queue. We presented a few cases in which the optimal policy can be explicitly determined, 
and studied a heuristic policy that performs well in a heavy-traffic system. 

Because our study focused on the scheduling aspect of the screening operation, we as- 
sumed that the surveillance system has perfect sensitivity and perfect specificity. If the 
surveillance system would erroneously classify a terrorist as a nonterrorist (false negative) 
with a certain probability, then the performance of the surveillance system described in this 
paper would simply be discounted by that probability. If false positive errors are also possi- 
ble, then the actions taken by the authorities would incur a social cost associated with the 
disruption of normal daily life. This cost, however, is typically much smaller than that of a 
successful terrorist attack. 

There are a few related research directions that can follow from our study. First, the 
probability of classification errors can be incorporated into the model as a function of the time 
a target is under surveillance. The longer the surveillance system monitors a target, the more 
likely the classification would be correct. In this case, the service time becomes a controlled 
variable rather than a random parameter. Second, it is possible to extend the queueing 
model to allow multiple servers and more than two types of customers (e.g., terrorists and 
criminal fugitives). We believe that mathematical modeling along these research lines has 
the potential to advance the effort on counterterrorism and homeland security. 



20 



References 



[1] What happened at the Lod Airport in 1972? http://www.palestinefacts.org/pL1967to 
199Llod.1972.php. Palestine Fact. 

[2] Dimitris Bertsimas and Georgia Mourtzinou. Multiclass queueing systems in heavy traf- 
fic: An asymptotic approach based on distributional and conservation laws. Operations 
Research, 1997. 

[3] Donald Gross and Garl M. Harris. Fundamentals of Queueing Theory, chapter 2.9. 
Wiley, 2nd edition, 1985. 

[4] J. Michael Harrison. Dynamic scheduling of a multiclass queue: Discount optimality. 
Operations Research, 23{2):270-282, 1975. 

[5] J. Michael Harrison and Assaf Zeevi. Dynamic scheduling of a multiclass queue in the 
halfin- whitt heavy traffic regime. Operations Research, 52{2):243-257, 2004. 

[6] Sheldon H. Jacobson, Laura A. McLay, John E. Kobza, and Jon M. Bowman. Modeling 
and analyzing multiple station baggage screening security system performance. Naval 
Research Logistics, 52(l):30-45, 2005. 

[7] Edward Kaplan and Moshe Kress. Operational effectiveness of suicide bomber detec- 
tor schemes: A best-case analysis. Proceedings of the National Academy of Sciences, 
102(29): 10399-10404, 2005. 

[8] Edward H. Kaplan, Ghristopher A. Patton, William P. FitzGerald, and Lawrence M. 
Wein. Detecting bioterror attacks by screening blood donors: A best-case analysis. 
Emerging Infectious Diseases, 9{8):909-914, 2003. 

[9] Moshe Kress. The effect of crowd density on the expected number of casualties in a 
suicide attack. Naval Research Logistics, 52(l):22-29, 2005. 

[10] Averill M. Law and W. David Kelton. Simulation Modeling and Analysis. McGraw-Hill, 
New York Gity, NY, 3rd edition, 2000. 

[11] Laura A. McLay, Sheldon H. Jacobson, and John E. Kobza. A multilevel passenger 
screening problem for aviation security. Naval Research Logistics, 53(3):183-197, 2006. 

[12] Bruce L. Miller. A queueing reward system with several customer classes. Management 
Sciences, 16(3):234-245, 1969. 

[13] Tava Lennon Olsen. A practical scheduling method for multiclass production systems 
with setups. Management Science, 45(1):116-130, 1999. 

[14] Erica Plambeck, Sunil Kumar, and J. Michael Harrison. A multiclass queue in heavy 
traffic with throughput time constraints: Asymptotically optimal dynamic controls. 
Queueing Systems, 39(l):23-54, 2001. 



21 



[15] Martin I. Reiman and Lawrence M. Wein. Dynamic scheduling of a two-class queue 
with setups. Operations Research, 46(4);532-547, 1998. 

[16] Sheldon M. Ross. Stochastic Processes. Wiley, 2nd edition, 1996. 

[17] Lawrence M. Wein and Yifan Liu. Analyzing a bioterror attack on the food supply; 
The case of botulinum toxin in milk. Proceedings of the National Academy of Sciences, 
102(28) :9984-9989, 2005. 

[18] Ronald W. Wolff. Poisson arrivals see time averages. Operations Research, 30(2) :223- 
231, 1982. 



22 



INITIAL DISTRIBUTION LIST 



1 . Research Office (Code 09) 1 

Naval Postgraduate School 

Monterey, CA 93943-5000 

2. Dudley Knox Library (Code 013) 2 

Naval Postgraduate School 

Monterey, CA 93943-5002 

3. Defense Technical Information Center 2 

8725 John J. Kingman Rd., STE 0944 

Ft. Belvoir, VA 22060-6218 

4. Richard Mastowski (Technical Editor) 2 

Graduate School of Operational and Information Sciences (GSOIS) 

Naval Postgraduate School 
Monterey, CA 93943-5219 

5. Assistant Professor Kyle Lin 1 

Operations Research Department 

Naval Postgraduate School 
Monterey, C A 93943-5219 

6. Professor Moshe Kress 1 

Operations Research Department 

Naval Postgraduate School 
Monterey, CA 93943-5219 

7. Assistant Professor Roberto Szechtman 1 

Operations Research Department 

Naval Postgraduate School ■ 

Monterey, CA 93943-5219 



23 



